Privacy and Security Cameras
A great number of businesses rely on camera surveillance for their security and crime prevention. But when you are filming situations and people, questions of privacy quickly arise. So it is not surprising that there are many Data Protection Agency decisions about camera surveillance.
Here’s what we’ve learned about privacy and security cameras.
1. Only film what is strictly necessary.
Security Cameras that are intended to monitor an access point (entrances and exits, thresholds, porches, doors, halls, etc.) may only have a field of vision limited to the area strictly necessary to visualize people preparing to access. A Luxembourg business was fined 12.500€ because its cameras also filmed surroundings and public space, instead of being limited to the actual entrance point. Another business was fined 7.600€ for the same reason.
Even inside of your place of business, you need to be careful. The Slovenian DPA held that a bar owner does not have a legitimate interest in monitoring the various rooms and outdoor terrace of the bar with video surveillance, but does have a legitimate interest in monitoring the bar counter and bar entrance. The bar in question was obliged to adjust the angles of their cameras. Therefore it is wise to reconsider placement of your security camera and privacy.
2. Always give correct information.
The Greek DPA imposed a fine of €15,000 euros on a company for illegal installation and operation of a video surveillance system in the offices of the employees and in the kitchen of the workplace. The DPA held that despite the cameras in question being disabled via software (showing a black box instead of the live feed in the CCTV software), the company should have informed its employees on the operational status of the installed cameras, quoting among other things, the “chilling effect” that a non-operational camera might have on employees who might think it is in operation.
3. Check your local law to see how long you can keep the footage.
The Luxembourg DPA fined a business €1900 for keeping video images during an excessive retention period. Local Luxembourg law allows a retention period of one week, that might be extended to 1 month, for specific purposes, when justified. In this case the footage was kept for 3 months. As these allowed retention periods may vary in different countries, make sure you check your local law.
4. Make sure you inform your employees and the general public.
The Luxembourg DPA fined a business €1000 for capturing images of a public space using their video-camera system, and for not providing necessary information about the video-camera system in accordance with Article 13 GDPR. The DPA found that the business offered limited information on the video surveillance system, both to users and to employees, and failed to provide adequate notice about the system on their website.
Want to learn more about Privacy and GDPR, check out our free knowledge base and youtube channel for some free learning content.
